## 1. 创建用户和角色
$ mysql -h 192.168.1.100 -P 4000 -u root -p -e “CREATE USER ‘fgedu’@’%’ IDENTIFIED BY ‘password’;”
$ mysql -h 192.168.1.100 -P 4000 -u root -p -e “CREATE ROLE ‘fgedu_role’;”
$ mysql -h 192.168.1.100 -P 4000 -u root -p -e “GRANT SELECT, INSERT, UPDATE, DELETE ON fgedudb.* TO ‘fgedu_role’;”
$ mysql -h 192.168.1.100 -P 4000 -u root -p -e “GRANT ‘fgedu_role’ TO ‘fgedu’@’%’;”

## 2. 配置密码策略
$ tiup cluster edit-config fgedu-tidb-cluster
tidb_servers:
– host: 192.168.1.100
config:
security:
password-policy:
validate-password:
policy: ‘STRONG’
length: 8
mixed-case: true
number: true
special: true

## 3. 启用TLS/SSL
$ tiup cluster edit-config fgedu-tidb-cluster
tidb_servers:
– host: 192.168.1.100
config:
security:
ssl:
enabled: true
ca-path: /tidb/certs/ca.pem
cert-path: /tidb/certs/tidb-server.pem
key-path: /tidb/certs/tidb-server-key.pem

tikv_servers:
– host: 192.168.1.101
config:
security:
ssl:
enabled: true
ca-path: /tidb/certs/ca.pem
cert-path: /tidb/certs/tikv-server.pem
key-path: /tidb/certs/tikv-server-key.pem

## 4. 配置连接限制
$ tiup cluster edit-config fgedu-tidb-cluster
tidb_servers:
– host: 192.168.1.100
config:
security:
connection-limit:
max-connections: 1000
max-connections-per-user: 100

## 5. 重启集群使配置生效
$ tiup cluster reload fgedu-tidb-cluster

## 1. 配置防火墙规则
$ firewall-cmd –permanent –add-port=4000/tcp
$ firewall-cmd –permanent –add-port=2379/tcp
$ firewall-cmd –permanent –add-port=26257/tcp
$ firewall-cmd –permanent –add-port=9000/tcp
$ firewall-cmd –reload

## 2. 配置网络隔离
$ cat > /etc/network/interfaces << EOF auto eth0 iface eth0 inet static address 192.168.1.100 netmask 255.255.255.0 gateway 192.168.1.1 auto eth1 iface eth1 inet static address 10.0.0.100 netmask 255.255.255.0 EOF ## 3. 配置SSH访问控制 $ cat > /etc/ssh/sshd_config << EOF PermitRootLogin no PasswordAuthentication no PubkeyAuthentication yes AllowUsers fgedu Port 2222 EOF ## 4. 配置入侵检测系统 $ yum install -y ossec-hids-server $ systemctl start ossec-hids $ systemctl enable ossec-hids ## 5. 配置网络监控 $ yum install -y netdata $ systemctl start netdata $ systemctl enable netdata

## 1. 最小化安装
$ yum groupinstall -y “Minimal Install”

## 2. 定期更新
$ yum update -y

## 3. 配置安全参数
$ cat > /etc/sysctl.d/security.conf << EOF # 禁用IP转发 net.ipv4.ip_forward = 0 # 启用SYN cookies net.ipv4.tcp_syncookies = 1 # 禁用ICMP重定向 net.ipv4.conf.all.accept_redirects = 0 net.ipv4.conf.default.accept_redirects = 0 # 禁用源路由 net.ipv4.conf.all.accept_source_route = 0 net.ipv4.conf.default.accept_source_route = 0 # 启用反向路径过滤 net.ipv4.conf.all.rp_filter = 1 net.ipv4.conf.default.rp_filter = 1 EOF ## 4. 配置文件权限 $ chmod 600 /etc/passwd $ chmod 600 /etc/shadow $ chmod 600 /etc/ssh/sshd_config ## 5. 禁用不必要的服务 $ systemctl stop firewalld NetworkManager avahi-daemon bluetooth cups $ systemctl disable firewalld NetworkManager avahi-daemon bluetooth cups ## 6. 配置日志管理 $ cat > /etc/rsyslog.conf << EOF *.info;mail.none;authpriv.none;cron.none /var/log/messages authpriv.* /var/log/secure mail.* -/var/log/maillog cron.* /var/log/cron *.emerg :omusrmsg:* EOF

## 1. 数据分类
$ mysql -h 192.168.1.100 -P 4000 -u fgedu -p -e “CREATE TABLE fgedudb.fgedu_personal_data (id INT PRIMARY KEY, name VARCHAR(255), email VARCHAR(255), phone VARCHAR(20), address VARCHAR(255));”

## 2. 数据处理
$ mysql -h 192.168.1.100 -P 4000 -u fgedu -p -e “ALTER TABLE fgedudb.fgedu_personal_data ADD COLUMN consent BOOLEAN DEFAULT FALSE;”

## 3. 数据访问控制
$ mysql -h 192.168.1.100 -P 4000 -u root -p -e “CREATE ROLE ‘gdpr_role’;”
$ mysql -h 192.168.1.100 -P 4000 -u root -p -e “GRANT SELECT ON fgedudb.fgedu_personal_data TO ‘gdpr_role’;”
$ mysql -h 192.168.1.100 -P 4000 -u root -p -e “GRANT ‘gdpr_role’ TO ‘fgedu’@’%’;”

## 4. 数据删除
$ mysql -h 192.168.1.100 -P 4000 -u fgedu -p -e “CREATE PROCEDURE delete_personal_data(IN user_id INT) BEGIN DELETE FROM fgedudb.fgedu_personal_data WHERE id = user_id; END;”

## 5. 数据导出
$ tiup dumpling -h 192.168.1.100 -P 4000 -u fgedu -p password -B fgedudb -T fgedu_personal_data -o /tidb/export/personal_data

## 1. 数据加密
$ tiup cluster edit-config fgedu-tidb-cluster
tidb_servers:
– host: 192.168.1.100
config:
security:
ssl:
enabled: true
ca-path: /tidb/certs/ca.pem
cert-path: /tidb/certs/tidb-server.pem
key-path: /tidb/certs/tidb-server-key.pem

## 2. 访问控制
$ mysql -h 192.168.1.100 -P 4000 -u root -p -e “CREATE ROLE ‘pci_role’;”
$ mysql -h 192.168.1.100 -P 4000 -u root -p -e “GRANT SELECT, INSERT, UPDATE, DELETE ON fgedudb.fgedu_payment_data TO ‘pci_role’;”
$ mysql -h 192.168.1.100 -P 4000 -u root -p -e “GRANT ‘pci_role’ TO ‘fgedu’@’%’;”

## 3. 审计日志
$ tiup cluster edit-config fgedu-tidb-cluster
tidb_servers:
– host: 192.168.1.100
config:
security:
audit-log:
enabled: true
log-file: /tidb/log/tidb-audit.log
log-level: info

## 4. 漏洞扫描
$ yum install -y openvas
$ openvas-setup
$ openvas-start

## 5. 安全测试
$ mysql -h 192.168.1.100 -P 4000 -u fgedu -p -e “SELECT * FROM fgedudb.fgedu_payment_data WHERE card_number LIKE ‘%1234’;”

## 1. 使用TiDB Dashboard监控
# 访问 http://192.168.1.100:10080/dashboard
# 查看安全相关指标

## 2. 使用Prometheus监控
# 访问 http://192.168.1.100:9090
# 查看安全相关指标

## 3. 配置安全告警
$ tiup cluster edit-config fgedu-tidb-cluster
alertmanager_servers:
– host: 192.168.1.100
config:
receivers:
– name: ’email’
email_configs:
– to: ‘security@fgedu.net.cn’
send_resolved: true
route:
group_by: [‘alertname’]
group_wait: 30s
group_interval: 5m
repeat_interval: 1h
receiver: ’email’
routes:
– match:
severity: critical
receiver: ’email’

## 4. 配置入侵检测
$ yum install -y ossec-hids-server
$ cat > /var/ossec/etc/ossec.conf << EOF

yes
security@fgedu.net.cn
smtp.fgedu.net.cn


rules_config.xml
sshd_rules.xml
syscheck_rules.xml
rootcheck_rules.xml


/tidb/log/tidb.log
syslog


/tidb/app


EOF

## 5. 监控网络流量
$ yum install -y netdata
$ systemctl start netdata
$ systemctl enable netdata

## 1. 配置审计日志
$ tiup cluster edit-config fgedu-tidb-cluster
tidb_servers:
– host: 192.168.1.100
config:
security:
audit-log:
enabled: true
log-file: /tidb/log/tidb-audit.log
log-level: info
audit-query: true
audit-query-log-limits: 1048576

## 2. 分析审计日志
$ grep “SELECT” /tidb/log/tidb-audit.log | grep “fgedu_users”
$ grep “UPDATE” /tidb/log/tidb-audit.log | grep “fgedu_payment_data”

## 3. 定期安全审计
$ cat > security_audit.sh << EOF #!/bin/bash # security_audit.sh # from:www.itpux.com.qq113257174.wx:itpux-com # web: http://www.fgedu.net.cn # 检查用户权限 mysql -h 192.168.1.100 -P 4000 -u root -p -e "SELECT user, host FROM mysql.user;" # 检查权限分配 mysql -h 192.168.1.100 -P 4000 -u root -p -e "SHOW GRANTS FOR 'fgedu'@'%';" # 检查审计日志 grep "ERROR" /tidb/log/tidb-audit.log # 检查安全配置 tiup cluster display fgedu-tidb-cluster EOF ## 4. 安全扫描 $ yum install -y nmap $ nmap -sV 192.168.1.100/24 ## 5. 漏洞评估 $ yum install -y openvas $ openvas-setup $ openvas-start $ gvm-cli --gmp-username=admin --gmp-password=admin socket --socketpath=/var/run/openvas/openvas.sock --xml="TiDB Security ScanTiDB Cluster192.168.1.100‘ | grep -oP ‘”